CVE-2025-58585 Sensitive Information Disclosure Through Missing Authentication

Medium 5.3 Published 6 Oct 2025 Updated 13 May 2026

Unauthenticated attackers can access sensitive information via unprotected endpoints in SICK analytics applications, requiring vendor patches.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-58585?

CVE-2025-58585 is a medium-severity missing authorization vulnerability in SICK AG Baggage Analytics, published on 6 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.

Weakness: CWE-497

Which versions are affected by CVE-2025-58585?

It affects 4 products.

Products include Sick Baggage Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.

How do I fix CVE-2025-58585?

No fix has been published for CVE-2025-58585 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-58585 being exploited?

There is no known exploitation of CVE-2025-58585 in the wild and no public exploit code.

Sources

Also known as GHSA-654c-35qv-mg5r.